Gdpr breach at work?

[Ereerenownow]

I've written on here a couple of times about issues at work but now a new problem has arisen, I think.
I an a private person and don't for example celebrate my birthday at work (though I obviously have a great time with friends and family).
Our office is big and busy and many people from different departments hot desk there. One young girl who uses our space has vague links to nhs via her community counselling work. She isn't employed by the nhs but has the logo on her lanyard as well as her charity's logo.
We are relatively friendly and have often chatted briefly in the kitchen while making a cuppa etc. One time she asked my age and birthday and i very politely said that i don't discuss those things at work. It was no big deal and we moved on to talk about other things.
Well this week she approached me with a wink and said, I know how old you are and you look great for your age and I'll give you a card on your birthday now.
I haven't told anyone else in the team my birthday and I don't believe myself and this lady have any friends in common...I am not on any social media.
I suspect she has access to at least some nhs files and databases and I'm worried that she has used her logins to access my records.
She's lovely but quite gossipy and I think she's capable of telling others in my team.
She also very vaguely alluded to a recent health issue I've had but didn't tell anyone about.
I admit given recent events at work, I'm slightly sensitive so I don't want to cause any problems if non exist.
Can I check to see if she's accessed my private nhs records? Am I just being paranoid?

The simplest solution is to not be so weird about your birthday.

What vague links do you mean? The NHS is a business as a whole, but made up of separate companies, so I’ve go surgery can’t access another’s surgery patients notes, or hospital notes etc, so unless was you’ve had dealings with that NHS department, it’s unlikely they’ll have your records on file.

Has she asked hr?

How does that stop people accessing your health records?
It's not weird to not want to give your DOB to a colleague.

OP, looking at your many previous posts about this place I would really suggest you find another place to work.
It sounds like a nightmare place to work and you clearly don't fit in there. It has been months and months of issues. It's just not worth it.

No HR system should allow line managers access to personal information such as birthdays or even home addresses, it's not "need to know" information and comes under GDPR. (ie HR should not be sharing it for anything other than the purpose it was collected).

Yes she’s probably had a nose somewhere she shouldn’t.

Is it worth her losing her job for? It’s your DOB, not like another post I saw where she found poster was pregnant and told everyone.

Like a precious poster said, you could have just said your birthday is July etc. It’s not like you’re sharing details about your family set up or your children etc.

I would try and forget it and if she mentions it up say what was suggested before about she clearly got it from somewhere she shouldn’t and walk away and let her stew.

its a glorious day (where I am anyway) don’t waste any more time on this!

Don't report her, don't contact HR, don't tell her. As others have said, ask for an audit of who has accessed your records and whether this person is on it.

Then you will know.

Amazed at the people banging on about it being weird not to tell people your birthday. OP clearly mentioned that to explain that the woman wouldn't have found out from other colleagues.

I agree. I have a team and pur hr system does not have their date of births or home addresses.

Hi thanks for all of your messages and support. I'm not sure why some people are calling me weird for not sharing my birthday. I simply dont want people at work to know. Is that really so strange..genuine question?
I'm not tetchy about my age or anything but these people are not my friends...I honestly don't get the pressure from some to share this information.

Very very few office based NHS staff have ( limited) access to the spine, and only if absolutely a requirement to do their job. We have a couple of nominated people across our organisation who we can ask for specific info ie which GP practice a patient is registered with, DoB, check NHS numbers - as part of our job, but not medical records.

I'd contact the IG person with this issue. your colleague might have asked someone else to look it up for her.

Have you ever been listed on Companies House eg as a director/ company secretary for example, as that can have info such as month and year of birth and is publicly available.

Not excusing her as I find her behaviour weird, but maybe she's looked it up elsewhere?

I agree with you on the not sharing birthday with colleagues etc. I find it a bit cringey when colleagues make a big deal about birthdays.

She does sound odd. What's her role in the NHS? I will say that not everyone who works for the NHS has readily available access to patient records, databases or log ins find that kind of information. Most have limited, if any, access to where's this kind of information is stored. Everything is logged and it would be quite unusual for someone willing to risk their entire career to find out a colleagues birthday. I imaging she's probably done a bit of googling or asking the right people.

Would she have done something really weird like try to access your birth records?

How would she even be able to access your records with only your name? If she doesn’t actually work for the NHS then any access she does have would be limited to what she needs to have for her work. I think it would be wild to report her to the charity work for a hunch. I’d just straight up tell her you’re concerned about how she’s gotten the information, and can she please let you know or you’ll have to raise it more formally.

As is referring to someone who is presumably an adult as 'a young girl'.

You both sound very odd in different ways.

It's just a bit odd! I haven't heard of anyone who feels this way before, unless they are worried about aging. It's not really personal information per se.

It does sound like you're very odd about your birthday OP. Why be so secretive? I totally get it's your business but I don't understand what you think will happen if your colleagues know your birthdate? What are you trying to hide? Are you secretly Dorian Gray and don't want people to know you're over 200 years old?

How is this relevant to whether or not her records have been accessed? She's mentioned that to explain why it wouldn't be common knowledge.

My son finds it incredibly awkward when people at work make a big deal / pointless small talk about of his birthday so doesn't offer up the information. That's simply it. I don't think it's that unusual.

Yes it is really strange in my experience, I have worked for 15+ years and never come across anyone so private about trivial details such as age/birthday.

I know a couple of people who don't broadcast their age and their birthdays

They have good reason and it's no-one else's business, frankly

I've always chosen to keep my birthday private.This year I've had a landmark birthday and was particularly pleased to have kept it secret as 2 close family members had terminal illnesses and I really wouldn't have wanted celebrations while I was spending most evenings in a hospice.
Workplaces are diverse and not everyone shares our views or knows what's going on behind the scenes so I think you should just ignore her.Would your details be on social media?

Honestly! Has no one any right to any privacy anymore?

Why do people want to 'celebrate' someone's birthday when they don't want it?

@StumbleInTheDebris lots of people have questioned why the OP is so cagey, why are you singling me out?

Fact is, we don't know how the other person found the information out? Maybe it was a GDPR breach, maybe it wasn't? If it bothers OP that much she can report it. If it was a breach then yes that is wrong of the other person to do but I still would wonder why they are so uptight about it.

I think what I find puzzling is that DOB is such a non-piece of information really. You have to give it out for practically everything these days so is hardly class it under the official secrets act. Surely answering 'it's in x month but I prefer not to make a big thing out of it' would suffice?

Mind you, I'm a big kid about my birthday and still get excited about it!